Discussion:
Linux /proc question (re: Pipes)
Add Reply
Kenny McCormack
2021-09-16 16:43:17 UTC
Reply
Permalink
When I do: ls -lsa /proc/<pid>/fd
I often see fds open on pipes, and the notation is like:

3 -> pipe:[123456]

where 123456 is a sequence of usually between 6 and 8 digits. My question
is: To what does this number map? What does it mean?

Almost certainly, there is something else in /proc that contains this
number and identifies the pipe in use. Usually, I'm pretty good about
sussing things like this out - usually the answer is in "man /proc", but
this one has me stumped.
--
The people who tell us to be proud of the white race are the ones who make
us the most embarrassed by it.
Scott Lurndal
2021-09-16 16:45:57 UTC
Reply
Permalink
Post by Kenny McCormack
When I do: ls -lsa /proc/<pid>/fd
3 -> pipe:[123456]
where 123456 is a sequence of usually between 6 and 8 digits. My question
is: To what does this number map? What does it mean?
First guess, the pid of the process on the other side of the pipe (which
may be the same process or a child process).
Rainer Weikusat
2021-09-16 17:06:04 UTC
Reply
Permalink
Post by Scott Lurndal
Post by Kenny McCormack
When I do: ls -lsa /proc/<pid>/fd
3 -> pipe:[123456]
where 123456 is a sequence of usually between 6 and 8 digits. My question
is: To what does this number map? What does it mean?
First guess, the pid of the process on the other side of the pipe (which
may be the same process or a child process).
It's the inode number of the pipe.
Nicolas George
2021-09-16 18:01:52 UTC
Reply
Permalink
Post by Scott Lurndal
First guess, the pid of the process on the other side of the pipe
There is absolutely no chance of that, since several processes can have the
same file descriptor.
Ralf Fassel
2021-09-16 17:33:04 UTC
Reply
Permalink
* ***@shell.xmission.com (Kenny McCormack)
| When I do: ls -lsa /proc/<pid>/fd
| I often see fds open on pipes, and the notation is like:
| 3 -> pipe:[123456]
| where 123456 is a sequence of usually between 6 and 8 digits. My
| question is: To what does this number map? What does it mean?

https://man7.org/linux/man-pages/man5/proc.5.html
[...]
/proc/[pid]/fd/
This is a subdirectory containing one entry for each file
which the process has open, named by its file descriptor,
and which is a symbolic link to the actual file. Thus, 0
is standard input, 1 standard output, 2 standard error,
and so on.

For file descriptors for pipes and sockets, the entries
will be symbolic links whose content is the file type with
the inode. A readlink(2) call on this file returns a
string in the format:

type:[inode]

For example, socket:[2248868] will be a socket and its
inode is 2248868. For sockets, that inode can be used to
find more information in one of the files under
/proc/net/.

HTH
R'
Kenny McCormack
2021-09-16 17:43:27 UTC
Reply
Permalink
In article <***@akutech.de>, Ralf Fassel <***@gmx.de> wrote:
...
Post by Ralf Fassel
type:[inode]
For example, socket:[2248868] will be a socket and its
inode is 2248868. For sockets, that inode can be used to
find more information in one of the files under
/proc/net/.
HTH
It pretty much tells me things I already knew.

What I'm looking for is "What can I do with this number?" You say it is an
"inode" number, but I doubt it is matches to a file in the file system.
I.e., you would do: find / -inum 123456 -ls

Longer term, what I am really looking for is "Who is on the other end of
this pipe?"
--
The randomly chosen signature file that would have appeared here is more than 4
lines long. As such, it violates one or more Usenet RFCs. In order to remain
in compliance with said RFCs, the actual sig can be found at the following URL:
http://user.xmission.com/~gazelle/Sigs/RightWingMedia
Rainer Weikusat
2021-09-16 17:45:31 UTC
Reply
Permalink
Post by Kenny McCormack
...
Post by Ralf Fassel
type:[inode]
For example, socket:[2248868] will be a socket and its
inode is 2248868. For sockets, that inode can be used to
find more information in one of the files under
/proc/net/.
HTH
It pretty much tells me things I already knew.
What I'm looking for is "What can I do with this number?" You say it is an
"inode" number, but I doubt it is matches to a file in the file system.
I.e., you would do: find / -inum 123456 -ls
Longer term, what I am really looking for is "Who is on the other end of
this pipe?"
Assuming you know the inode number, lsof | grep <inode number> will tell
you that (ls -l /prroc/*/fd | grep ...).
Kenny McCormack
2021-09-20 18:54:06 UTC
Reply
Permalink
In article <***@doppelsaurus.mobileactivedefense.com>,
Rainer Weikusat <***@talktalk.net> wrote:
...
Post by Rainer Weikusat
Post by Kenny McCormack
Longer term, what I am really looking for is "Who is on the other end of
this pipe?"
Assuming you know the inode number, lsof | grep <inode number> will tell
you that (ls -l /prroc/*/fd | grep ...).
Yeah, it may come to that.

But I was hoping for more of a "metal detector" type solution, rather than
searching the entire haystack looking for the needle. I.e., more of a "go
here" answer, than a "polling" answer.

But, thanks...
--
Modern Conservative: Someone who can take time out from demanding more
flag burning laws, more abortion laws, more drug laws, more obscenity
laws, and more police authority to make warrantless arrests to remind
us that we need to "get the government off our backs".
Ralf Fassel
2021-09-17 08:50:01 UTC
Reply
Permalink
* ***@shell.xmission.com (Kenny McCormack)
| Longer term, what I am really looking for is "Who is on the other end
| of this pipe?"

I just did a

$ cat | cat

$ ps -ef | grep cat
UID PID PPID C STIME TTY TIME CMD
user 28788 28758 0 10:42 pts/4 00:00:00 cat
user 28789 28758 0 10:42 pts/4 00:00:00 cat

$ ls -l /proc/28788/fd
l-wx------ 1 user group 64 Sep 17 10:42 1 -> pipe:[6418237]

$ ls -l /proc/28789/fd
lr-x------ 1 user group 64 Sep 17 10:42 0 -> pipe:[6418237]

While there seems to be no file on /proc with that inode:

$ find /proc -inum 6418237 2>/dev/null
[nada]

you could ls -l /proc/*/fd and check for the same inode listed in the
last field. Don't know how bullet-proof this is...

R'
Eric Pozharski
2021-09-17 09:32:50 UTC
Reply
Permalink
Post by Kenny McCormack
Post by Ralf Fassel
type:[inode]
For example, socket:[2248868] will be a socket and its
inode is 2248868. For sockets, that inode can be used to
find more information in one of the files under
/proc/net/.
HTH
It pretty much tells me things I already knew.
What I'm looking for is "What can I do with this number?" You say it
is an "inode" number, but I doubt it is matches to a file in the file
system. I.e., you would do: find / -inum 123456 -ls
Longer term, what I am really looking for is "Who is on the other end
of this pipe?"
If it's listening, then probably nothing. Anyway, quick grep through
'man lsof' suggests '/proc/net/unix'.
--
Torvalds' goal for Linux is very simple: World Domination
Stallman's goal for GNU is even simpler: Freedom
Rainer Weikusat
2021-09-17 17:59:47 UTC
Reply
Permalink
Post by Eric Pozharski
Post by Kenny McCormack
Post by Ralf Fassel
type:[inode]
For example, socket:[2248868] will be a socket and its
inode is 2248868. For sockets, that inode can be used to
find more information in one of the files under
/proc/net/.
HTH
It pretty much tells me things I already knew.
What I'm looking for is "What can I do with this number?" You say it
is an "inode" number, but I doubt it is matches to a file in the file
system. I.e., you would do: find / -inum 123456 -ls
Longer term, what I am really looking for is "Who is on the other end
of this pipe?"
If it's listening, then probably nothing. Anyway, quick grep through
'man lsof' suggests '/proc/net/unix'.
A pipe is not a UNIX domain socket (listed in /proc/net/unix).
Eric Pozharski
2021-09-18 12:45:16 UTC
Reply
Permalink
*SKIP*
Post by Rainer Weikusat
Post by Eric Pozharski
Post by Kenny McCormack
Post by Ralf Fassel
For example, socket:[2248868] will be a socket and its
inode is 2248868. For sockets, that inode can be used to
find more information in one of the files under
/proc/net/.
It pretty much tells me things I already knew.
What I'm looking for is "What can I do with this number?" You say
it is an "inode" number, but I doubt it is matches to a file in the
file system. I.e., you would do: find / -inum 123456 -ls
Longer term, what I am really looking for is "Who is on the other
end of this pipe?"
If it's listening, then probably nothing. Anyway, quick grep through
'man lsof' suggests '/proc/net/unix'.
A pipe is not a UNIX domain socket (listed in /proc/net/unix).
Indeed (as you can see, pipes quickly diverted to sockets as easier
targets). As pointed out in <si2qip$8e1$***@dont-email.me> pipes don't
manifest in something like /proc/net/unix. Scanning through
/proc/[0-9]*/fd/* then.
--
Torvalds' goal for Linux is very simple: World Domination
Stallman's goal for GNU is even simpler: Freedom
Lew Pitcher
2021-09-17 19:33:45 UTC
Reply
Permalink
Post by Kenny McCormack
...
Post by Ralf Fassel
type:[inode]
For example, socket:[2248868] will be a socket and its
inode is 2248868. For sockets, that inode can be used to
find more information in one of the files under
/proc/net/.
HTH
It pretty much tells me things I already knew.
What I'm looking for is "What can I do with this number?" You say it is an
"inode" number, but I doubt it is matches to a file in the file system.
I.e., you would do: find / -inum 123456 -ls
Longer term, what I am really looking for is "Who is on the other end of
this pipe?"
Sorry, but I don't think you will be able to answer that question directly.

Apparently, from reading /usr/src/linux/fs/pipe.c, Linux implements pipes
within a pseudo-filesystem called "pipefs". Those inode numbers refer to
inodes within this pseudo-filesystem.

According to Linux.org (among others),
"Pipefs is a unique virtual filesystem. This filesystem is mounted
inside the kernel rather than in the userspace. While most filesystems
are mounted under "/", PipeFS is mounted on "pipe:", making PipeFS its
own root (yes, a second root filesystem). This filesystem is one
superblock and cannot exceed that amount system-wide. The entry point
of this filesystem/second-root is the system-call "pipe()". Unlike
the other virtual/pseudo filesystems, this one cannot be viewed."
(https://www.linux.org/threads/pipefs-sockfs-debugfs-and-securityfs.9638/)

So, those pipe inode numbers address inodes in a filesystem that is not
externalized to /any/ subtree of /. This makes it difficult to use userland
utilities (like find, for instance) on the pipefs, and thus makes analysis
of individual pipe pairs /very/ difficult.

IDK, but you /might/ be able to explicitly mount pipefs to some part of the
filesystem tree. I can't guarantee that this will work, nor can I speculate
on /if/ any userland utility would be able to access it to provide you with
the information you seek.

HTH
--
Lew Pitcher
"In Skills, We Trust"
Kenny McCormack
2021-09-20 18:54:42 UTC
Reply
Permalink
In article <si2qip$8e1$***@dont-email.me>,
Lew Pitcher <***@digitalfreehold.ca> wrote:
...
Post by Lew Pitcher
Sorry, but I don't think you will be able to answer that question directly.
Yeah, that's kinda what I feared.
--
The coronavirus is the first thing, in his 74 pathetic years of existence,
that the orange menace has come into contact with, that he couldn't browbeat,
bully, bullshit, bribe, sue, legally harrass, get Daddy to fix, get his
siblings to bail him out of, or, if all else fails, simply wish it away.
Kenny McCormack
2021-09-27 13:49:28 UTC
Reply
Permalink
In article <si2qip$8e1$***@dont-email.me>,
Lew Pitcher <***@digitalfreehold.ca> wrote:
...
Post by Lew Pitcher
IDK, but you /might/ be able to explicitly mount pipefs to some part of the
filesystem tree. I can't guarantee that this will work, nor can I speculate
on /if/ any userland utility would be able to access it to provide you with
the information you seek.
# mkdir /tmp/ook
# mount -t pipefs none /tmp/ook
mount: /tmp/ook: wrong fs type, bad option, bad superblock on none, missing codepage or helper program, or other error.
# mount -t pipes none /tmp/ook
mount: /tmp/ook: unknown filesystem type 'pipes'.
# mount -t proc none /tmp/ook
#
--
Indeed, most .NET developers couldn't pass CS101 at a third-rate
community college.
- F. Russell -
Loading...